Worm Threat Forces Apple To Disable Software?

SkiifGeek writes "After the debacle that surrounded the announcement and non-disclosure of a worm that targets OS X, the vulnerability in mDNSResponder may have forced Apple to remove support for certain mDNSResponder capabilities with the recently released Security Update 2007-007. 'Seeming to closely follow the information disclosed by InfoSec Sellout, Apple's mDNSResponder update addresses a vulnerability that can be exploited by an attacker on the local network to gain a denial of service or arbitrary code execution condition. Apple goes on to identify that the vulnerability that they are addressing exists within the support for UPnP IGD... and that an attacker can exploit the vulnerability through simply sending a crafted network packet across the network. With the crafted network packet triggering a buffer overflow, it passes control of the vulnerable system to the attacker. Rather than patching the vulnerability and retaining the capability, Apple has completely disabled support for UPnP IGD (though there is no information about whether it is only a temporary disablement until vulnerabilities can be addressed).'"

*Pulls out a plate 'o crow*

Come here Apple fanboys-and-girls. Lunch is served.

Re:wait a minute

Realistically, no OS is completely secure. This is hardly the first security issue in OS X, nor will it be the last. Linux has had its share of security flaws, too.

In the modern world, there are simply too many protocols and systems popping up; no operating system exists in a vacuum, and many vulnerabilities may be in services, subsystems and so on. And with the pressure to get things out and shave off extra CPU cycles, there are too many situations where someone simply goes 'oh, well, I checked that this data is valid up HERE, so I don't need to check again down here in this function I call later,' and then later another piece of code goes, 'oh, look, here is a function that does what I need, I will just reuse it' and assumes that function does its own error-checking, so does not check the data before passing into it. And thus, you create a pathway where unvalidated data gets passed down and can cause buffer overflows or whatever.

No operating system or development team is somehow inherently immune to this.

The thing is that Windows not only has kept large chunks of legacy code -- which makes it hard to really break down and restrict user permissions without breaking older programs -- but spent some time really pushing the Active X technology, which then proved to create a lot of problems. Apple, on the other hand, went off the tracks entirely and threw out their operating system; that was a risky move which could have killed them off entirely, but in the end they got an operating system which was built atop a multi-user system with better permissions.

That does not mean that Apple somehow writes inherently better code than Microsoft; I happen to like OS X, but Apple's engineers are not necessarily smarter or more careful in the actual lines of code they write. The difference as I see it is that Microsoft is bogged down by hard-to-debug and support legacy code, while Apple got to make a cleaner start... and then on top of that, many bits of OS X (CUPS, zeroconf/Bonjour, WebKit, etc.) are open source.

Apple contributes funds and engineering to these projects (and in some cases such as zeroconf, came up with the original specifications), but as they are open source things tend to get found and fixed faster in community review. That is why OS X, while not bulletproof, tends to be at least a bit more secure than Windows.

That is my take on it, anyway.

Re:*Pulls out a plate 'o crow*

This is what should happen. Fix it, or remove the feature, or at least make it optional. This is what Apple normally does. It does not ship with all ports open and sharing on.

I hope this indicates a return to sensibility at Apple. Lately they are trying so hard to be like MS, that the security has suffered. Can't turn off HTML in email is at the top of my security vulnerabilities.

News at 11...

Researchers find hole, act like 1337 733ns about it. Company can't be sure that they've fixed hole, so they temporarily disable the reportedly-vulnerable function.

Yawn.

Re:News at 11...

Hello, Artie McStrawman! Sure, there are a few idiots out there that believe that OS X is infallible - there are also some idiots out there that believe the same about windows or linux. However, you aren't likely to find them around here. You'll find plenty of people that believe that OS X is MORE secure than the some of the alternatives, largely because their heavy use of open source and their default configuration that ships with no open ports, but very few that think it is "inherently secure".

The proof is in the number of successful worms and viruses for OS X, which depending on how you define them, hover right around zero. Yes, some of this is likely because of market share, but there's plenty of bragging rights associated with creating the first large-scale OS X compromise, so I wouldn't expect to see none. And of course, even if the relatively low number of security issues is because of market share, it doesn't make it any less pleasant for those of us who use OS X, especially since I'm not expecting it's share to go over 15-20%.

Anyway, if I accept your statement that OS X isn't perfect, will you stop bitching about smug mac users every time there is a discussion marginally related to Apple?

Thanks,
gutter

Re:News at 11...

Smugness is in the eye of the beholder; unfortunately, there's often nothing that can be done either way, as a great many people aren't able to accept that something other than their chosen product (or OS in this case) might have something that theirs doesn't.

In other words, Ford Mustang owners tend to see Chevy Corvette owners as smug. Neither side is really willing to appreciate that each has advantages the other doesn't possess, and can't stand it when somebody highlights the advantage. That isn't ever going to change

I don't see how the situation is any different when an operating system is concerned, rather than a brand of vehicle.

Here's a news flash: OS X has advantages over Windows, Linux, and FreeBSD. OS X can brag about security, because there is a far smaller percentage of its users that have infected, compromised, or zombified machines. Ffind reasons to discount that fact is meaningless: It doesn't matter if the number of attackers is smaller; the goal is to not fall victim to an attack, which OS X has an excellent record of doing.

Here's another one: Macintoshes have disadvantages: They don't have as much native software. A virtualization product like VMware or Parallels is a rare sight on Windows, yet is quite common on a Macintosh. There's always some app that only exists for Windows that the user can't live without. So Mac users not only pay $130 for OS X, but also $80 for a virtualization product, and then they have to buy the most expensive license for Windows. Mac software doesn't enjoy the "freedom" that most Linux users enjoy; much of the software for the Mac is closed-source.

Still, you don't have to like it when OS X users dismiss the advantages of other OSes (like the amount of software for Windows, or the freeness of Linux).

Just take the time to realize that's it's a different flavor of the time-honored "Chevy vs Ford" debate. What is "better" depends on the way the beholder sees things, and it's childish to believe that there's only one true way.

Standard Operating Procedure?

I'm not opposed to temporarily disabling functionality to fix something potentially disastorous. However, I do hope Apple doesn't make it a practice of just turning things off once exploits are found. Turn it off, patch it, then re-enable it is fine by me.

Re:Standard Operating Procedure?

I'm not opposed to temporarily disabling functionality to fix something potentially disastorous.

There are three options when implementing UPnP:

1. Implement it to Microsoft's spec.
2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
3. Implement it securely.

Choose only one.

I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.

Re:Standard Operating Procedure?

I'm not opposed to temporarily disabling functionality to fix something potentially disastorous.

There are three options when implementing UPnP:

1. Implement it to Microsoft's spec.
2. Implement it correctly (by choosing a direction in places the spec contradicts itself or real implementations).
3. Implement it securely.

Choose only one.

I do not think it is possible to implement UPnP securely and have it based on the spec. Also, the specific code they removed existed only for legacy NAT traversals and may not even be needed any more.

Is this the same UPnP capability that the FBI recommeded disabling [pcworld.com] in any Windows environment due to security issues quite some time ago?

Re:Standard Operating Procedure?

I call bullshit. You are saying it's not possible to implement UPnP without being vulnerable to a buffer overflow that may lead to remote code execution? Because that's one of the (at least) two issues at hand. Nice try on passing the responsibility for this bug to the spec writers (mentioning Microsoft seems to help too),

Uhm, UPnP is a microsoft created and controlled spec, this is why I specifically mentioned Microsoft. Some people think it's not microsoft related because Microsoft hides their name from being easily found on the site (they do the same thing with the Zune). But, do a whois [networksolutions.com] on upnp.org or look at many of the UPnP documents [upnp.org] and you will see Microsoft's name plastered all over.

Can you show me an implementation of UPnP that hasn't had bugs? According to wikipedia [wikipedia.org] security is a problem with the spec itself. It's getting so bad that some major router manufacturers are disabling the routing of UPnP packets by default on their non-consumer (and a few consumer) networking appliances.

And my list was more of a dig at OOXML rather than being security related.

Um, so ?

Apple find a vulnerability (before the worm is announced, according to TFA), and remove that vulnerability in their next security update.

I'm guessing there's a regular scheduled security update process in Apple. If you can't fix it in time for the next patch-release, isn't is *better* to temporarily disable it ? I really doubt it's a permanent removal of the feature - they're just being responsible.

Simon.

ITS A LIE

I'm sorry but the article must be a lie. The Apple fanboys assure me that there's no risk of vulnerabilities. Therefore, the article is wrong - it does not exist.

OT but...

I often wonder why the British (and now some Americans) say "Apple go on to identify..." Apple is ONE company. Shouldn't that be the singular "Apple goes on to identify"? If it were both Apple and Microsoft than indeed it would be "Apple and Microsoft go on to identify".

Yes, Apple is made up of many people; but my car is made up of many parts. You don't say "my car need gas" do you?

This perplexes me, can someone explain it? Sorry if it's completely OT (except that this (to me) error is in the blurb).

-mcgrew

(amusingly, the capcha is "contrary". Again sorry for being OT)

Apple ... Worm

So an "apple" is threatened by a "worm"... you don't say.

Hmmm...

Isn't mDNSResponder and Open Source package ported for OS X?

  http://developer.apple.com/opensource/internet/bon jour.html [apple.com]

Is Apple the developer of mDNSResponder or are they just using it?

Re:Hmmm...

An Apple employee (Stuart Cheshire [stuartcheshire.org]) is one of the authors of the RFC(s) related to mDNS [multicastdns.org], etc.

mDNSResponder originated from Apple.

Sensationalism by Zonk

Hey Zonk, how about using more reputable sources than one guy's blog for your links? I know they were picked by the submitter, but linking only to a blog and then putting a question mark after the headline is sketchy. I can't put much faith in the article if I can't be sure that it's not just a blogger talking out of his ass.

Shouldn't this be optional?

Although I can understand the "secure-by-default" ethos, it would seem to me that some people could leave the vulnerable service active because they only use their computer in firewalled physical LAN environment. Does this update come with a new preference panel entry to reenable this mDNS service?

TV add

Does this mean that the MAC guy from the TV add will get fired?

Re:TV add

"Hi, I'm a Mac"

"And I'm a PC. Hey Mac, I heard you don't get viruses. Congratulations."

*PC Shakes Mac's hand*

"That's right, PC. But I do have worms."

*PC starts wiping hand furiously*

At least they disabled it!

I mean, it was a given that, given increasing market share, Apple becomes interesting for malware. No system is 100% secure.

But at least they decided that it's better to disable the feature and minimize the damage to the net as a whole (and yes, even if you don't have an Apple, a worm damages you by clogging your tubes with packets trying to spread itself). MS decided that it's better to keep the insecure service up and running 'til it can be addressed.

Question for 100: Still getting sober/blaster packets? I do.

Apple did the right thing

Yes, I understand that there are certainly dissenting opinions here. But (IMHO) the thing that most Slash-bots complain about is that Microsoft will

A) Pick a feature that's dumb. (like embed a scripting language into an image format, or give a spreadsheet scripting language access to the filesystem)

B) Choose to preserve the dumb feature in spite of known security problems.

C) Treat the resulting backlash as a "PR issue" rather than a technical one.

D) Sometimes, if the backlash gets bad enough, they'll hack in security restrictions in response to specific known implementations that take advantage of the vulnerability rather than fix the vulnerability. EG: fixes that look for a XXX worm trace, rather than fix the thing that XXX worm exploits. (See anti-virus [wikipedia.org])

Apple is doing the right thing, here, folks! It may or may not be that the feature mentioned is analogous to (A) above. Either way, Apple is chosing security over features, even though features are important.

The obvious solution

Switch to Avahi!

3...2...1....

...EXCUSE CITY!

"additional validation" or "disabled support"

If you follow the link to the apple security update page there are actually two vulnerabilities associated with UPnP IGD. For one of them apple indicates that "this update addresses the issue by performing additional validation when processing UPnP protocol packets in iChat". For mDNSResponder apple indicates "this update addresses the issue by removing UPnP IGD support.

Clearly something is unclear since iChat is obviously still using UPnP IGD, likely as a client?

But why is the mDNSResponder using UPnP IGP anyway? mDNS is for service discovery etc and is basically a competitor to UPnP (I thought). Perhaps there is a way for mDNSResponder to leverage UPnP IGP to broadcast service messages (e.g. bonjour) across a local NAT? If so I've never seen nor heard of this working -- so perhaps what they're disabling is vulnerable code that wasn't doing anything anyway?

Who wants to bet...

... that the iPhone will be the vector that finally gets Macs infected with a virus/worm that will replicate in the wild?

I bet there's a secret cabal at Microsoft that is working on this very thing.

Does anyone use mDNS?

This stupid mDNS thing is always enabled on every system I install and I always have to disable it. Does anyone actually use this Microsoft crap?

Re:Does anyone use mDNS?

mDNS - Apple
UPNP - Microsoft

Apple have disabled the Microsoft protocol. Won't affect them in the slightest I'd expect.

mDNS is actually fairly useful.. you can advertise servers across the network using it, and it's an easy protocol to implement (a few hundred lines of code will do it).

UPNP is an XML infested mess with a huge spec that I wouldn't try to implement unless I had a deathwish. And in all that mess they forgot to add any user or machine verification.. the upshot being if you enable it on a router you can disable its firewall with a 10 line perl script.

What's worse...

A worm in your Apple, or half a worm?

Lets all Welcome Apple

to a world where the more famous you become(as in increased user base) the more will be your enemies. Microsoft is fighting this battle for a long long time.
Apple will realize this in very soon.

Now that Apple has disabled uPnP compatibility....

Now that Apple has disabled uPnP compatibility will the original anonymous extortionist reveal the hole that he claims he didn't want to reveal lest Apple come up with some excuse for not disabling whatever his hole was, or will we hear more FUD from him?

Big Loss!

UPnP kind of sucks anyway. Maybe this will get people to move to MDNS-SD, which is simple, straightforward, has several implementations (both open source and not).

Apple should have stayed vulnerable

Silly Apple, fixing the problems. Don't they know this leaves them open for taunting.

Knee-jerk PC fanboi: "Oh, I guess Apple isn't so secure after all, huh?"

Mac-fanboi: "Umm, they fixed a problem with some 3rd-party software before it became an issue."

Knee-jerk PC fanboi: "Yeah, old Apple finally getting some of what Windows gets."

Mac-fanboi: "No, they proactively fixed the problem"

Knee-jerk PC fanboi: "Yep, might as well just use Windows"

Mac-fanboi: "You do that, then."

Re:Is the Adobe Bloat Suite on windows vulnerable?

It's not just Dreamweaver; Photoshop CS3 does the same. Not only that, but it installs the service with the name "##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762 ##", so it's not exactly easy to spot.

Here is a page with instructions about how to remove it (read the full thread; the first post has an error):

http://www.x64bit.net/site/board/index.php?showtop ic=4214 [x64bit.net]

Moderations tell all

Just because you mark it flamebait doesn't make it less true.

Re:Moderations tell all

I'm just going to collect a few of your more inane tidbits together here:

"Apple failed" (they did not)

"OS X is every bit as crash prone and unreliable as Windows" (It's crash prone, but not "every bit as crash prone")

"not so with Apple, which radically changes their OS every few years" (Two points here: 1. if this is true, it belies your following statement 2. it's not true)

"There is no inherently superior security in OS X" (the overall design and implementation of OS X is more secure than the overall design and implementation of XP. Vista is a vast improvement over XP, but it remains to be seen how this works out)

"those people who blame Microsoft for vendor lock-in" (straw man, no one claims this)

"OS X is the ultimate in vendor lock-in" (OS X is an extremely open system. The only "lock-in" is with their hardware, which really isn't that big of a deal.)

For someone who claims to be fighting against religious zeal, you sure come across fanatically angry. You make the basic fallacy that, "Windows is flawed, OS X is flawed, therefore Windows and OS X are equally flawed," which is complete nonsense.

There are people who get fanatical about Macs, but you're lumping a whole lot of rational people in with them, and fully deserve flaimbait or troll modding for it.

the minute you take a bite of the precious worm-ridden Apple, mods put you to sleep for a year

No, stupid shit like, "eat crow" gets modded down. Eat crow for what? A security flaw existed? It was patched? WTF? A lot of anti-Apple sentiment gets modded up, as well, though generally the more rational stuff, like people complaining about vendor lock-in (like you did above) or various other things that actually make sense.

Not to mention the fact that both you, and the OP are both (at present) modded positively, which makes your cries of being oppressed a bit silly.

Re:Worm author quoted as saying...

Watch I'll show you how it works. The apple fanboi moderator club is pretty big and like all monomaniacs are poised to protect their little gem from any tarnish.